Make WordPress Core


Ignore:
Timestamp:
09/19/2017 03:02:57 PM (6 years ago)
Author:
aaroncampbell
Message:

Database: Hardening for wpdb::prepare()

Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.

Merges [41470] to 3.9 branch.

Location:
branches/3.9
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/3.9

  • branches/3.9/src/wp-includes/wp-db.php

    r33995 r41480  
    12011201        $args = func_get_args();
    12021202        array_shift( $args );
     1203
    12031204        // If args were passed as an array (as in vsprintf), move them up
    1204         if ( isset( $args[0] ) && is_array($args[0]) )
     1205        if ( is_array( $args[0] ) && count( $args ) == 1 ) {
    12051206            $args = $args[0];
     1207        }
     1208
     1209        foreach ( $args as $arg ) {
     1210            if ( ! is_scalar( $arg ) ) {
     1211                _doing_it_wrong( 'wpdb::prepare', sprintf( 'Unsupported value type (%s).', gettype( $arg ) ), '3.9.20' );
     1212            }
     1213        }
     1214
    12061215        $query = str_replace( "'%s'", '%s', $query ); // in case someone mistakenly already singlequoted it
    12071216        $query = str_replace( '"%s"', '%s', $query ); // doublequote unquoting
Note: See TracChangeset for help on using the changeset viewer.